xfs_repair: strengthen geometry checks

In xfs_repair, the inodelog, sectlog, and dirblklog values are read
directly into the xfs_mount structure without any sanity checking by the
verifier.  This results in xfs_repair segfaulting when those fields have
ridiculously high values because the pointer arithmetic runs us off the
end of the metadata buffers.  Therefore, reject the superblock if these
values are garbage and try to find one of the other ones.  Clean up the
dblocks checking to use the relevant macros.

The superblock field fuzzer (xfs/1301) triggers all these segfaults.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Eric Sandeen <sandeen@sandeen.net>

diff --git a/repair/globals.h b/repair/globals.h
index efd1d03b21be0e5083189c6768de725b50e586e8..4085ccc43a67c32131d02080aebf82675b02221e 100644 (file)
--- a/repair/globals.h
+++ b/repair/globals.h
@@ -50,7 +50,8 @@
 #define XR_BAD_SB_WIDTH                18      /* bad stripe width */
 #define XR_BAD_SVN             19      /* bad shared version number */
 #define XR_BAD_CRC             20      /* Bad CRC */
-#define XR_BAD_ERR_CODE                21      /* Bad error code */
+#define XR_BAD_DIR_SIZE_DATA   21      /* Bad directory geometry */
+#define XR_BAD_ERR_CODE                22      /* Bad error code */
 
 /* XFS filesystem (il)legal values */
 

diff --git a/repair/sb.c b/repair/sb.c
index 004702c52d9a7e387e2073022fbdc2600bd37e64..77e51546f2b25a96552bcbdd3fe5a807aeb06d23 100644 (file)
--- a/repair/sb.c
+++ b/repair/sb.c
@@ -395,20 +395,22 @@ verify_sb(char *sb_buf, xfs_sb_t *sb, int is_primary_sb)
        /* sanity check ag count, size fields against data size field */
 
        if (sb->sb_dblocks == 0 ||
-               sb->sb_dblocks >
-                       ((__uint64_t)sb->sb_agcount * sb->sb_agblocks) ||
-               sb->sb_dblocks <
-                       ((__uint64_t)(sb->sb_agcount - 1) * sb->sb_agblocks
-                       + XFS_MIN_AG_BLOCKS))
+               sb->sb_dblocks > XFS_MAX_DBLOCKS(sb) ||
+               sb->sb_dblocks < XFS_MIN_DBLOCKS(sb))
                return(XR_BAD_FS_SIZE_DATA);
 
        if (sb->sb_agblklog != (__uint8_t)libxfs_log2_roundup(sb->sb_agblocks))
                return(XR_BAD_FS_SIZE_DATA);
 
-       if (sb->sb_inodesize < XFS_DINODE_MIN_SIZE ||
-               sb->sb_inodesize > XFS_DINODE_MAX_SIZE ||
-               sb->sb_inopblock != howmany(sb->sb_blocksize,sb->sb_inodesize))
-               return(XR_BAD_INO_SIZE_DATA);
+       if (sb->sb_inodesize < XFS_DINODE_MIN_SIZE                     ||
+           sb->sb_inodesize > XFS_DINODE_MAX_SIZE                     ||
+           sb->sb_inodelog < XFS_DINODE_MIN_LOG                       ||
+           sb->sb_inodelog > XFS_DINODE_MAX_LOG                       ||
+           sb->sb_inodesize != (1 << sb->sb_inodelog)                 ||
+           sb->sb_logsunit > XLOG_MAX_RECORD_BSIZE                    ||
+           sb->sb_inopblock != howmany(sb->sb_blocksize, sb->sb_inodesize) ||
+           (sb->sb_blocklog - sb->sb_inodelog != sb->sb_inopblog))
+               return XR_BAD_INO_SIZE_DATA;
 
        if (xfs_sb_version_hassector(sb))  {
 
@@ -492,7 +494,12 @@ verify_sb(char *sb_buf, xfs_sb_t *sb, int is_primary_sb)
                if ((sb->sb_unit && !sb->sb_width) ||
                    (sb->sb_width && sb->sb_unit && sb->sb_width % sb->sb_unit))
                        return(XR_BAD_SB_WIDTH);
-       }
+       } else if (sb->sb_unit || sb->sb_width)
+               return XR_BAD_SB_WIDTH;
+
+       /* Directory block log */
+       if (sb->sb_blocklog + sb->sb_dirblklog > XFS_MAX_BLOCKSIZE_LOG)
+               return XR_BAD_DIR_SIZE_DATA;
 
        return(XR_OK);
 }

diff --git a/repair/xfs_repair.c b/repair/xfs_repair.c
index 5c79fd95e6fda2ed4f08bc5ccb104d090da70249..b07567bfcbd8f7dc8765c189526568c4c476588d 100644 (file)
--- a/repair/xfs_repair.c
+++ b/repair/xfs_repair.c
@@ -143,6 +143,8 @@ err_string(int err_code)
                        _("bad shared version number in superblock");
                err_message[XR_BAD_CRC] =
                        _("bad CRC in superblock");
+               err_message[XR_BAD_DIR_SIZE_DATA] =
+                       _("inconsistent directory geometry information");
                done = 1;
        }